live-hlp-lagr[.]pages[.]dev

This domain is under investigation for brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site is designed to deceive users into believing they are interacting with legitimate Ledger Live software, likely for the purpose of crypto asset theft or credential harvesting. The specific threat type is brand impersonation with potential crypto drainer functionality, given the target brand's association with digital asset management. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. It resolves to the IP address 172.66.45.23 and was created on April 30, 2026, an anomalous future date suggesting domain registration manipulation. The domain appears on one security blocklist and is blocked by PhishDestroy, though VirusTotal currently shows 0/95 detections. The Gridinsoft trust score is 0/100, and the page title mimics Ledger’s official branding: "Ledger® Live: | Getting Started™ with Ledger®." Technologies detected include HSTS, Cloudflare infrastructure, and HTTP/3, which are consistent with modern phishing campaigns leveraging legitimate hosting services to evade detection. Mitigation steps for this threat type include immediate domain blocking at the network level, particularly for endpoints handling cryptocurrency transactions. Organizations should update web filtering rules to flag domains impersonating Ledger or other crypto wallet providers, focusing on patterns like "live-hlp" or similar subdomain structures. Users should be educated to verify domain authenticity by cross-referencing official Ledger communication channels and avoiding interaction with unsolicited links. Given the domain’s current offline status, monitoring for re-emergence under similar naming conventions is recommended, as threat actors frequently recycle infrastructure. Security teams should also investigate the IP 172.66.45.23 for additional malicious domains and assess whether internal systems have interacted with this infrastructure.